t-mobile[.]lvipcq[.]top

This domain, t-mobile.lvipcq.top, presents a high-risk phishing threat designed to impersonate T-Mobile's official portal. Analysis indicates the site employs social engineering techniques to deceive users into submitting login credentials, payment details, or other sensitive information under false pretenses. The page title, 'Welcome to OpenResty!', suggests the use of a reverse proxy or web server framework, which may be leveraged to obscure malicious backend infrastructure or facilitate credential harvesting. Infrastructure analysis reveals the domain was registered on May 28, 2026, through NameSilo, LLC, an unusually future-dated creation that may indicate an attempt to bypass reputation-based security controls. It resolves to the IP address 104.21.62.101 and is hosted behind Cloudflare, utilizing HTTP/3 and Cloudflare Browser Insights, likely to enhance performance and evade traditional detection methods. Security vendor assessments on VirusTotal flag the domain as malicious, with 13 out of 95 engines detecting it. Additionally, the domain appears on one security blocklist and is explicitly blocked by at least one anti-phishing system. Google Safe Browsing categorizes the threat as 'SOCIAL_ENGINEERING', confirming its intent to manipulate users. Users who visited t-mobile.lvipcq.top should immediately assume their credentials or other sensitive data may have been compromised. Recommended actions include changing passwords for any accounts accessed after visiting the domain, enabling multi-factor authentication where available, and monitoring financial statements for unauthorized transactions. If payment details were entered, affected parties should contact their financial institution to dispute potential fraudulent charges. System scans using updated security tools are advised to detect any secondary infections or persistent threats. Organizations should add the domain and its associated IP (104.21.62.101) to internal blocklists to prevent further exposure.